Yes, this would be true in the case of adding a random string as a second salt but then this would have to be sent to the client also. I am not sufficiently fa

Yes, this would be true in the case of adding a random string as a second salt but then this would have to be sent to the client also. I am not sufficiently familiar with KDFs but I know that rainbow tables exist to crack straight up md5 hashed passwords for common usernames and passwords where the username has been used as the salt. Maybe harder to do with a KDF because it's prohibitive to compute that many keys in the first place?